Apache Batik prior to 1.16 allows RCE via scripting
Priority LOW 39CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
Why it matters now
EPSS 0.03355 88th percentileScored 2026-11-07
Fix Partial org.apache.xmlgraphics:batik (Maven): 1.16org.apache.xmlgraphics:batik-bridge (Maven): 1.16Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache XML Graphics | Batik – 1.15 | — | No fix listed | CNA |
| — | org.apache.xmlgraphics:batik (Maven) | before 1.16 | 1.16 | Patch available | GHSA-rwqr-m72q-v6cm |
| — | org.apache.xmlgraphics:batik-bridge (Maven) | before 1.16 | 1.16 | Patch available | GHSA-rwqr-m72q-v6cm |
- Apache XML Graphics VendorApache Affected Batik – 1.15 Fixed in — No fix listed CNA
- org.apache.xmlgraphics:batik (Maven) Vendor— Affected before 1.16 Fixed in 1.16 Patch available GHSA-rwqr-m72q-v6cm
- org.apache.xmlgraphics:batik-bridge (Maven) Vendor— Affected before 1.16 Fixed in 1.16 Patch available GHSA-rwqr-m72q-v6cm
Remediation
- Fix · GHSA-rwqr-m72q-v6cm org.apache.xmlgraphics:batik (Maven) Fixed in 1.16 Advisory →
- Fix · GHSA-rwqr-m72q-v6cm org.apache.xmlgraphics:batik-bridge (Maven) Fixed in 1.16 Advisory →
Red Hat 2 advisories
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache XML Graphics — DSA-5264
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-20096 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG inputPriority MEDIUM 44
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-42890
- 2026-10-03 Alias added: GHSA-rwqr-m72q-v6cm
References
Advisory 6
Other 6
- https://github.com/apache/xmlgraphics-batik/commit/401aa8595f52d085d40ff5b6b4ac0dd372423082
- https://github.com/apache/xmlgraphics-batik/commit/52f7a1ad6e3110ec295a35ffc94410eef085707a
- https://github.com/apache/xmlgraphics-batik/commit/eada57c716a2757579d53017f8b2aeadaad20edd
- https://issues.apache.org/jira/browse/BATIK-1345
- https://xmlgraphics.apache.org/security.html
- http://svn.apache.org/repos/asf/xmlgraphics/batik/trunk
More Apache Batik vulnerabilities
- TI-2018-05790 Deserialization of untrusted data in Apache Batik CVSS 3.0CRITICAL 9.8
- TI-2020-09647 Improper input validation in Apache Batik CVSS 3.1HIGH 8.2
- TI-2019-13109 Server-side request forgery in Apache Batik CVSS 3.1HIGH 7.5
- TI-2015-00219 XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion… CVSS 2.0MEDIUM 6.4
- TI-2022-20096 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input CVSS 3.1HIGH 7.5
- TI-2022-19036 Jar url should be blocked by DefaultScriptSecurity CVSS 3.1HIGH 7.5
Sources
- CVE-2022-42890 · CVE Program
- CVE-2022-42890 · NVD
- FIRST EPSS
- GHSA-rwqr-m72q-v6cm · GitHub Advisory Database · CC BY 4.0
- CVE-2022-42890 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences